Thanks for reply. In my case, the problem seemed to resolve itself once
I set the MaxDataSize parameter for imprelp (previously unset, now 128k)
to the same value as global.maxmessagesize (128k as listed below).
Are those two parameters related? With the explicit setting of the
MaxDataSize parameter messages that were previously "stuck", flow once more.
On 10/29/2017 1:22 PM, Rainer Gerhards wrote:
quick answer: I guess you ran into this
https://github.com/rsyslog/rsyslog/issues/1741
Let me know if more info is needed.
Rainer
2017-10-29 19:15 GMT+01:00 deoren
<rsyslog-users-lists.adiscon....@whyaskwhy.org>:
I originally sent this as part of another thread, but I think this got
buried and lost among the noise the rest of my notes generated. Posting a
cleaner version here in case others know the answer.
I'm trying to avoid using legacy configuration options where I can, but just
in case the order of the configuration settings matters, I've set the
maxMessageSize global parameter prior to loading the imrelp module and the
configuring the imrelp input. I should note that the sending system and the
receiving system both have the exact same collection of global() object
parameters and values.
Illustration:
#######################################
global (
maxMessageSize="128k"
action.reportSuspension="on"
action.reportSuspensionContinuation="on"
workDirectory="/var/spool/rsyslog"
processInternalMessages="off"
parser.permitSlashInProgramName="on"
)
# more config settings here ...
input(
type="imrelp"
port="2514"
KeepAlive="on"
ruleset="receiver-rsyslog-JSON-payload-parsing"
)
#######################################
Even so, the maxMessageSize parameter value did not seem to be used by the
imrelp input; the client debug log showed repeat retries to send queued
messages.
Since I explicitly configured MaxDataSize on the imrelp input I've not seen
this problem reoccur:
#######################################
global (
maxMessageSize="128k"
action.reportSuspension="on"
action.reportSuspensionContinuation="on"
workDirectory="/var/spool/rsyslog"
processInternalMessages="off"
parser.permitSlashInProgramName="on"
)
# more config settings here ...
input(
type="imrelp"
port="2514"
KeepAlive="on"
ruleset="receiver-rsyslog-JSON-payload-parsing"
MaxDataSize="128k"
)
#######################################
Reading over the documentation for imrelp, I found this:
MaxDataSize <size_nbr>
Default is the global message size
Sets the max message size (in bytes) that can be received. Any messages
above this size will be rejected causing the relp client to reconnect and
retry.
The "reconnect and retry" sounds exactly like what I'm experiencing, though
there isn't anything in the non-debug log which indicates that and I'm not
familiar enough with the debug format to be comfortable saying that what I'm
experiencing is exactly what is happening.
This bit gives me the impression that the default global() maxMessageSize
parameter is what imrelp uses unless the MaxDataSize parameter is
specifically set.
Default is the global message size
Is that true or are those values separate? Are they intended for different
purposes? Are they separate, but loosely related?
refs: https://github.com/rsyslog/rsyslog/issues/1782
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
